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Abstract 

The Hughston-Jozsa-Wootters theorem shows that any finite en- 
semble of quantum states can be prepared "at a distance" , and it has 
been used to demonstrate the insecurity of all bit commitment proto- 
cols based on finite quantum systems without superselection rules. In 
this paper, we prove a generalized HJW theorem for arbitrary ensem- 
bles of states on a C*-algebra. We then use this result to demonstrate 
the insecurity of bit commitment protocols based on infinite quantum 
systems, and quantum systems with Abelian superselection rules. 

I. Introduction 

Recent work in quantum cryptography has focused on questions of which 
sorts of information-transfer protocols are secure from attempts at cheating 
by an intruder or by one of the participants. As early as 1984, the question 
was raised whether quantum theory would permit a secure bit commitment 
protocol — i.e., a protocol in which a bit of information is committed by 
one party Alice to another party Bob, such that Alice cannot change her 
commitment, and such that Bob cannot determine Alice's commitment until 
given further information by Alice. An initial protocol using pairs of polarized 
photons was proposed by Bennett and Brassard [2]; however, Bennett and 
Brassard showed that this protocol can be cheated by exploiting the nonlocal 
correlations of the EPR-Bohm state. 
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A number of other quantum bit commitment protocols have been pro- 
posed in the intervening years (see jHIB] for reviews). Most of these protocols 
rely on the fact that a non-pure density operator corresponds to more than 
one ensemble of quantum states. In particular, two different ensembles on a 
composite system can induce the same density operator on a local system. 
Thus, if Alice encodes her bits into these two ensembles, then Bob cannot 
possibly determine Alice's commitment until she provides further information 
about the composite system. 

However, Lo and Chau jl5j and Mayers [121 HZ] show that, as a conse- 
quence of the Hughston-Jozsa-Wootters theorem, if a bit commitment pro- 
tocol is concealing against Bob, then it is not binding against Alice. (Kent's 
fn\ relativistic bit commitment protocol does not rely on the existence of al- 
ternative decompositions of a density operator, and so its security is not chal- 
lenged by the Mayers-Lo-Chau result.) That is, if the ensembles prepared in 
the protocol are indistinguishable to Bob (i.e., correspond to approximately 
the same local density operator), then Alice can "steer" between these en- 
sembles after the Commit stage of the protocol. 

HJW Theorem ([lOj). LetTiA andTiB he finite- dimensional Hilhert spaces, 
let {Di}"^^^ he density operators onTiB, o,nd let x he a unit vector in Ha^'Hb 
such that Tta{Px) = Yl^=i ^i^i- Then there are positive operators {A}r=i 
in B(Ha) ® I such that 



Thus, the HJW theorem shows that any finite decomposition of Tr^(P^.) 
can be prepared from the state by a measurement operation on Ha- How- 
ever, all non-pure density operators have countably infinite convex decom- 
positions, as well as uncountably infinite integral decompositions. For the 
case of countably infinite decompositions, Cassinelli et al. have proved a 
generalized HJW theorem; but their results do not cover the case of inte- 
gral decompositions. What is more, the HJW theorem and its generalization 
by Cassinelli et al. apply only to a very narrow class of quantum systems 
— namely those whose observables are represented by type I von Neumann 
factors. Thus, these results do not directly establish the insecurity of bit 
commitment protocols that employ systems with non-trivial superselection 
rules (represented by direct sums of type I von Neumann factors), or bit 
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for all B el^BiUB). 



2 



commitment protocols that employ infinite quantum systems (represented 
by type II or type III von Neumann algebras). 

In this paper, we prove a generalized HJW theorem for arbitrary en- 
sembles of states on a C*-algebra. We show first (in Section II) that each 
measure on the state space of a C*-algebra B gives rise to a positive-operator 
valued measure with range in the commutant B' of B. (This first result is 
completely general, and does not impose any restrictions on the C*-algebra 
B.) We then show that when B' is a hyperfinite von Neumann algebra, there 
is a completely positive instrument that prepares the relevant ensemble of 
states on B. In Section III we apply our results to the question of the security 
of bit commitment protocols. 

II. Generalized HJW theorem 

Our first result (Theorem ^ shows that for any C*-algebra B of operators 
acting on a Hilbert space Ti, a measure on the state space of B gives rise 
to a corresponding POV measure with values in the commutant B' = {A e 
B{n) : [A,B] = for all B G B}. For the case that B = I ® Mn, where 
Ain is the C*-algebra of n x n matrices over C, our result yields an alternate 
proof of the original HJW theorem. 

Let K denote the compact convex set of states of B with the weak* 
topology. [A net {iOa}a£A of states of B converges in the weak* topology to 
a state u just in case, for each B ^ B, \imaUJa{B) = u{B). li B = M.m 
then the weak* topology on states is equivalent to the standard topology 
on density operators.] In this paper, we consider positive regular measures 
on (K, S), where S is the Borel a-algebra of K. When we say that is a 
measure, it can be assumed that /i is positive and regular. 

Definition ([T, p. 12]). If /i is a measure on the state space K, then the 
state 



is called the barycenter of /i. Measures jj and u on K are said to be equivalent 
if they have the same barycenter. 

Let K be the convex set of density operators on C". If p is a density 
operator and /i is a finitely supported measure on K with barycenter p, then 
Hughston et al. call p a p- ensemble. So, the set of p-ensembles consists of 
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those measures on K that have barycenter p, and that are supported on a 
finite set. In this paper, we consider all measures with barycenter p, and not 
just those with finite support. 

Notation. If x is a vector in 7i, we let uj^^A) = {x \Ax) , for all A G B(H). 
If i3 is a set of operators on H, we let Bx = {Bx : B G S}, and we let [Bx] 
denote the closed linear span of Bx. 

Lemma 1 ( [13|, Prop. 7.3.5]). If B is a C*-algebra of operators acting 
on the Hilbert space Ti and p is a positive linear functional on B such that 
P < ^x\b for some vector x in Ti, then there is a positive operator H in the 
unit hall of B' such that p{A) = uJx{HA) = ujjji/2^{A), for all A E B. 

Proof. Define a conjugate-bilinear functional 93 on Bx by setting if {Ax, Bx) = 
p{A*B). Then, 

\^{Ax, = |p(A*S)|2 < p{A*A)p{B*B) < ||Axf ||5xf . (3) 

The first inequality follows from the Cauchy-Schwartz inequality for the inner 
product {A\B)p = p{A*B) on B. Thus Lp is positive and bounded by 1. 
It follows that (p has a unique extension to the subspace [Bx]. Moreover, 
the Riesz representation theorem entails that there is a positive operator H 
on [Bx] such that [\H[\ < 1 and (p{Ax,Bx) = {Ax \HBx) . In particular, 
p{A) = {x \HAx) = uj^{HA) for all AeB. Extend H to the entire Hilbert 
space H. by setting it to zero on 7i [Bx] . Since 



for all C in B, it follows that [H,C] = on [Bx]. Since [H,C] = on 
Ti. [Bx], it follows that [H, C] = on the entire Hilbert space. Therefore, 



The following result is a special case of a theorem proved by Tomita [22] 
in 1956 (compare with ^ Lemma 4.1.21, Prop. 4.1.22]). 

Theorem 1. Let B he a C*-algehra acting on the Hilhert space Ti, and let p 
he a prohahility measure on the state space of B. If there is a unit vector x 
in Ti such that Ux\b is the harycenter of p, then there is a POV measure A 
with range in B' such that 



{Ax \HCBx) 



p{A*CB) = p{{C*AyB) 
{C*Ax\HBx) = {Ax\CHBx) 



(4) 
(5) 



H G B'. 



□ 



{A{S) 



/^x\BA{Sf'^x) = I Lu{B)dp{Lu) 



Js 



(6) 
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for all S G Tj and B E B. 



Proof. Let Shea. Borel subset of the state space of i3, and let ps = fg udp^ioj). 
Then ps is a positive hnear functional on B with ps < uj^Ib- By Lemmas 
there is a positive operator A{S) in the unit ball of B' such that ps{B) = 
uj^{A{S)B) for all B e B, and A{S) = on H e [Bx]. In order to verify that 
5* t— > ^4(5) is countably additive, suppose that {Si : z G N} are disjoint Borel 
subsets, and let S = U^^S'„. Then for fixed B E B, 

oo 

Y,XsM-^{B) = xs{u;)-u;{B), (7) 

i=l 

and so the monotone convergence theorem entails that 

Yli^j ^iB)dfi{u)^ = j uo{B)d^{Lo) = {x\A{S)Bx) . (8) 
Furthermore, countable additivity of the map Z \—>- {x \ ZBx) entails that 

' oo \ \ oo 

^ A{S.;) \bx\ = 5^ (x \A{S.;)Bx) . (9) 
j=i / / i=i 

Replacing B with B*C, where B,C E B, we have 



Bx 



J2 A{Si)Cx ) = {Bx \A{S)Cx) , (10) 



1=1 



and therefore ^i^i))y = ^{S)y, for all y G [Bx]. Since A{S) = on 

n e [Bx], it follows that J2Zi MSi) = A{S). □ 

Thus, if /i is a measure on the state space of Bob's algebra B, Alice's 
algebra A = B' contains the range of a POV measure A satisfying Eqn. 
ini But this does not yet yield the conclusion that Ahce can prepare the 
ensemble p, on Bob's system — for that, we need to show that Alice has an 
"instrument" corresponding to the POV measure A. 

Definition (jHl I19| ). Let (A, S) be a Borel space. A completely positive 
(CP) instrument on B{H) is a map £ : T, x BiTi) BiTi) such that: 
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1. for fixed B G BiTi), £[ ■ ]{B) is a-additive in the weak-operator topol- 
ogy; 

2. for fixed G S, ■ ) is a completely positive linear map such that 
S[S]{I)<I. 

Since the map £[S]{ ■ ), (5* G S), is positive, it is automatically norm- 
continuous. If, in addition, each such map is weak-operator continuous on 
bounded sets, then £ is said to be normal. [A net {^ajaeA of bounded 
operators on 7i converges in the weak-operator topology to an operator A 
just in case lima \Aay) = {x \Ay) for all vectors x, y in H.] However, we do 
not require instruments to be normal, because continuous PV measures give 
rise to non- normal instruments 0123], and a continuous ensemble of states 
on B will give rise to a continuous PV measure in B'. 

Each instrument £ determines a unique POV measure A via the formula 

AiS)^£[S]{I), (Se^). (11) 
If Eqn. ^2 holds for an instrument £ and a POV measure A, then £ and A 
are said to be compatible. For any given POV measure A, there are many 
instruments that are compatible with A. In fact, if $ is a CP projection of 
BCH) with ran($) C ran(A)' then 

£[S]{B) = A{S)<^{B), {S eE,B eB{n)), (12) 

is compatible with A. In particular, if p is a state on i3(7i) then 

£[S]iB) = AiS)piB), (5 G G Bin)), (13) 

is compatible with A. 

Thus, given a POV measure A with range in Alice's algebra A = B', we 
can easily find an instrument £ that is compatible with A. However, it does 
not follow that Alice can in any sense measure A with the instrument £, 
because £ may not be "local" to Alice's system. In particular, an instrument 
that is local to Alice's system should not disturb the statistics of measure- 
ments of observables in Bob's algebra B = A'. In other words, for any state 
p on B, the equation 

pi£[X]iB))=piB), (14) 

should hold for all B e B. But Eqn. [H holds for all states p on B iS the CP 
map ^[-'^]( ■ ) is the identity on B. Thus, we capture the locality requirement 
with the following definition. 
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Definition. An instrument £ is local to an algebra ^ just in case £[S]{B) = 
£[S]{I)B, for all B e A' and S e S. 

Of course, if A is a POV measure on N, there is a canonical instrument 
S'^ that is compatible with A and local to any algebra containing ran(A): 

£^[Sm = J2 aTbA]!\ (S C N, 5 g B{n)). (15) 

We wish to extend this result to show that for each POV measure A with 
range in a C*-algebra A, there is a CP instrument £^ that is compatible 
with A and local to A. In this paper, we prove this result for finite quantum 
systems (Theorem |2I), and for infinite quantum systems that can be approx- 
imated, in an appropriate sense, by finite quantum systems (Theorem E)). 
While our proof for the finite case uses only elementary linear algebra, our 
proof for the infinite case is non-constructive (i.e., invokes the axiom of choice 
in the form of the Tychonoff product theorem), and uses tools from the theory 
of operator algebras. 

We first show that if Alice has a finite quantum system, then she can 
perform a "maximally disturbing" local operation — i.e., an operation that 
maps all her states to the maximally mixed state. 

Lemma 2. If A is finite- dimensional C* -algebra on the Hilbert space Ti then 
there is a completely positive projection $ from B{l-L) onto A! . In particular, 
$ maps A onto CI. 

Proof. (Compare with Prop. 8.3.11] and |23-) Since A is finite-dimensional, 
A = 0™ 1 -Mnii) for some positive integers n(l), . . . , n{m). Consider the fol- 
lowing statement: 

(t) There is a projective unitary representation g ^ W{g) of a 
finite group G in ^ such that {W{g) : g & G} spans A. 

We first show that (f) holds when A = Ain- Let {|0), . . . , |n — 1)} be a basis 
for C", and for each g E x let W{g) be the unitary operator on C"' 
defined by 

W{g)\a) = e'a^''\a + g,), (a = l,...,n). (16) 

Then g W{g) is a projective representation of Z„ x Z„ with bicharacter 
^{g,h) = e's^''^; i.e., W{g)W{h) = e'^^^^W {g + h) . Furthermore, {W{g) : 
(7 G Z2 X Z2} is an orthonormal basis for M.^ relative to the inner product 
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{A\B)2 = Ti{A*B). Thus, we have estabhshed (f) for the case that A = Mn- 
We now show that (f) holds when A= -^n(i)- Indeed, let 

m 

G = [Z„(,) X Z„(i)] , (17) 
1=1 

and take the direct sum of the corresponding projective representations. 

We now show that if (f) holds, then there is a CP projection from i3(7i) 
onto A'. For each g E G, define an automorphism ag of B(Ti.) by 

agiA) = WigyAWig), {BeB{H)). (18) 

Then Q = {ag : g E G} is a. finite group of automorphisms of BiTi). If 
a{A) = A for all aeG, then AW{g) = W{g)A for all g E G, and A e A'. 
Thus, 

$(A) = |^|-i5^a(A), {AeB{n)), (19) 

aeG 

is a CP projection from BiH) onto A'. □ 

We are now prepared to prove a generalized HJW theorem, valid for all 
finite quantum systems (i.e., systems whose algebra of observables is finite- 
dimensional). In particular, if the C*-algebra B' is finite-dimensional, then 
the product $ ® A of the maximally disturbing operation $ (from Lemma 
121) and the POV measure A (from Theorem ^ yields an instrument that 
prepares the ensemble fi on system B. 

Theorem 2 (Generalized HJW Theorem). Let B be a G* -algebra acting 
on the Hubert space 7i, let x be a unit vector in TC, and let fx be a measure 
on the state space of B such that Ux\b is the bary center of ^i. If B' is finite- 
dimensional then there is a CP instrument £ on B{l-L) that is local to B' and 

{x\£[S]{B)x) = [ uj{B)dfx{uj), (20) 
Js 

for all S E and B E B. 

Proof. By Lemma |2l there is a CP projection $ from i3(7i) onto A'. Let 
= $ (g) A, where A is the POV measure defined in Theorem That is, 

£[S]iB) = ^B)A{S), (21) 

for all 5 G S and B G B{H). □ 
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This generalized HJW theorem apphes to bit commitment protocols that 
employ continuous ensembles on finite quantum systems (e.g., continuous 
measures on the Bloch sphere), and to finite quantum systems with Abelian 
superselection rules (direct sums of matrix algebras). However, this first 
result leaves open the possibility of secure bit commitment protocols that 
employ infinite quantum systems. So, in the following subsection, we prove 
a more general HJW theorem that also applies to infinite quantum systems. 

II. 1 HJW theorem for hyperfinite algebras 

Definition. A von Neumann algebra TZ is said to be hyperfinite just in case 
there is an upward directed family {TZa}a€A of finite-dimensional C*-algebras 
such that 71 is the weak-operator closure of IJaGA^a- 

As in the finite case, an observer with a hyperfinite von Neumann algebra 
can perform a maximally disturbing measurement operation. 

Lemma 3. IfTZisa hyperfinite von Neumann algebra acting on the Hilbert 
space Ti then there is a completely positive projection $ from B{T-C) onto TZ' . 
In particular, $ maps TZ onto CI. 

Notation. For an arbitrary operator B in i3(7Y) we write con{B)^ for the 
weak-operator closed convex hull of {UBU* : U E TZ, U unitary}. 

Proof. (Compare with [131 Prop. 8.3.11; Exercise 8.7.24] and P21.) Let {TZa : 
a G A} be an increasing net of finite-dimensional C*-algebras on Ti, such that 

(aeA^a)" = 7^, (22) 

where X~ denotes the weak-operator closure of X. By Lemma for each 
a G A there is a CP projection from BiH) onto TZ'^ . Let 

^= n co7e(S)- (23) 

BeBiH) 

be the product topological space, where each factor is equipped with the 
weak-operator topology. For fixed B G BiH), coti{B)~ is weak-operator 
closed and bounded, and is therefore weak-operator compact ^31 Thm. 5.1.3]. 
Thus, the Tychonoff product theorem entails that X is compact. Let A4 be 
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the subset of X consisting of mappings $ that are positive, hnear, normahzed, 
and such that 

^B!,BB!^) = R'MB)R',, (24) 

for all R[,R'2 G 7^' and for all B e B{n). Since M is closed in X, M is 
compact, and {$a : a G A} has a limit point $ G Note that lima = ^ 
iff, for each fixed B G B{n), w-lim^ $a(S) = $(S). We claim that $(5) G 
for each B G BiTi). Let A G UaeA^ai ^'^^^ there is an m G A such that 
A G Tim- Then, A$a(5) = $^(5)^4, for all a > m. Since the maps Z v-^ AZ 
and Z 1-^ ZA are weak-operator continuous. 



w-lim<l>a(B) 

a>r?i 



w-lim [A$a(5)] 



W-lim $a(5) A. 



W-lim [$a(S)A] 

a>m 



(25) 
(26) 



Since $(-B) = w-lima<l>a(i?) = w-lima>m <l>a(S), it follows that A^{B) = 
^{B)A. Since A was an arbitrary element of UaGA'^a, '^'(-B) £ (UaGA^a)' ~ 
7^'. Therefore ran($) = TZ'. Finally, since $ is an 7?.'-bimodule mapping (i.e., 
Eqn. 1241 holds). $ is idempotent and completely positive fl^, Cor. 3.4]. □ 



Again, a maximally disturbing operation $ can be tensored with the 
POV measure A to yield an instrument that prepares the ensemble /z on 
Bob's system. 

Theorem 3 (Generalized HJW Theorem). Let B be a C* -algebra acting 
on the Hubert space H, let x be a unit vector in H, and let fj, be a measure on 
the state space of B such that uJx\b is the bary center of fi. If B' is hyperfinite 
then there is a CP instrument E on B{H) that is local to B' and 



{x\£[S]{B)x) = / uj{B)d^i{u 



(27) 



for all S ^ H and B E B. 



Proof. The proof is identical to the proof of Theorem |21 with Lemma El 
replacing Lemma |21 □ 
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III. Application to bit commitment 



The Mayers-Lo-Chau theorem shows that when A = M.n ® / and B = A', 
and when bits are encoded in finite ensembles, then {A, B) cannot be used to 
implement a secure bit commitment protocol. The generalized HJW theorem 
allows us to extend this result to the case where A (= B') is an arbitrary 
hyperfinite von Neumann algebra, and to encodings that employ arbitrary 
ensembles of states on B. In particular, the generalized HJW theorem entails 
that there can be no secure bit commitment protocol using infinite (hyper- 
finite) quantum systems, or quantum systems with Abelian superselection 
rules. 

III.l Bit commitment with infinite quantum systems 

The quantum bit commitment protocols that have been proposed to date 
employ finite quantum systems. In this subsection, we describe a bit com- 
mitment protocol that employs continuous ensembles of states on infinite 
qubit lattices. Since this protocol does not fall within the range of validity of 
the HJW theorem, it is immune to current no-go theorems against bit com- 
mitment. However, we show that this protocol can be cheated by exploiting 
the non-local correlations of an "infinitely entangled" EPR state (see jI2])- 
Let |0,0) and |0, 1) be orthogonal unit eigenvectors of a^, and let |1,0) 
and 1 1,1) be orthogonal unit eigenvectors of ay. Then, heuristically, the 
states of a one- dimensional infinite qubit lattice include vectors of the form 

\\b,s)) =def ®r=i\b,s{t)), (seizor), (28) 

with b = or b = 1. (We provide a rigorous definition of these states below.) 

During the Commit stage of the protocol, Alice performs operations on 
a composite {A, B) consisting of two lattice systems A and and she then 
sends system B to Bob. During the Unveil stage, Alice makes measurements 
on A, and sends classical information to Bob, who then makes measurements 
on B. 
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Commit: For b = 0,1, Alice chooses a random sequence s e (^2)'^, and 
prepares the state 

\\b,s))A ® \\b, s))b- 

Alice holds part A, and sends part B to Bob. (So, the ensemble Bob 
receives is an equal mixture over s)), for s e (22)^^.) 

Unveil: Alice measures the observable 

i=i 

on her systems, where = ^{I + ab) and 

P^(^) = / ® . . . 7 ® ® 7 ® . . . . 

(Each state \\b,s)) is an eigenstate of Ab, and when Si 7^ S2, ||^, Si)) 
and 1 1 6, S2)) assign different values to Ab.) Alice sends the results of 
her measurements (a list of numbers in the Cantor set) to Bob. Bob 
measures A^ on his systems and compares his numbers with Alice's. 
Bob accepts if the two lists agree, and rejects if the two lists disagree. 



Let pb be the state that Bob receives. It is intuitively clear that if Alice 
follows the protocol honestly then po — Pi, and so Bob cannot cheat. (We 
prove this fact below.) 

We now tighten up the mathematical description of the systems involved 
in the protocol. The observables of a one-dimensional qubit lattice are rep- 
resented by the C*-algebraic infinite direct product 

A^(^Mnii), (29) 

where n{i) — 2 for each i eN. For each i eN and A e M2, let 

A^'^ = I0---0I0A0I--- , (30) 

where A is in the i-th position. If for each i e N, 0;^ is a state of AI2, then 
there is a unique state <^°ZiUJi of A defined by 

{^r=i^,){A(^^)^u;M)- (31) 
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Furthermore, ®°ZiUJi is pure iff each Ui is pure, and is a trace iff each Ui 
is a trace ^Sl Prop. 11.4.7]. Thus, if {\i) : i G N} are unit vectors in C^, 
then can be used to denote the corresponding pure state of A. In 

particular, for any s G (^2)^, \\b,s)) does in fact correspond to a pure state 
of A. 

Let B be an isomorphic copy of A. Since ^ is a uniform hmit of an 
increasing sequence of finite-dimensional algebras, it is nuclear; i.e., there is 
a unique norm on the algebraic tensor product AQ B whose completion is 
a C*-algebra. We denote this C*-algebra by A<^ B. We now establish the 
existence of the ensembles described in the protocol, and we show that they 
give rise to the same quantum state (namely, the "maximally mixed" tracial 
state) on system B. 

Proposition 4. // /i is the normalized Haar measure on {1^2)'^ then there is 
a probability measure fib on the state space of A^ B such that 

l^b{{\\b,s))A^\\b,s))B ■.seS}) = fi{S), (32) 

for every Borel subset S of {'^2)'^ ■ Furthermore, if pb is the barycenter of pb 
then pb\i^B is the tracial state. 

To establish the first part of Proposition EJ it will suffice to show that 

s ^ \\b,s))A®\\b,s))B, (33) 

is a continuous mapping of (^2)"^ into the state space of A® B (with the 
weak* topology). For then the induced measure pb = P ° will satisfy 
Eqn.El 

Let G = X]jGN(^2 ffi ^2)1 be the direct sum of a countable number of 
copies of Z2 © Z2. Elements of G are sequences with values in Z2 © Z2 that 
differ from the identity (0, 0) in only finitely many positions. Let V(o,o) = I, 
^(0,1) = CTx, ^(1,0) = CTyy and V(i^i) = az, and for any s E G, let 

Uis) =def K(l) © Vs(2) © K(3) © ■ ■ ■ G ^. (34) 

Then the set {U{s) : s G G} is linearly dense in A. Let Hb denote the 
subgroup of G generated by those sequences s with the property that s(z) = 
(0,0) or s{i) = (&, 6 © 1) for all z G N. Then, {U{s) : s G Hb} generates an 
Abelian subalgebra of A; namely, the algebra generated by the spin operator 
V{b,beii) at each lattice site. 
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Lemma 5. If C is the Abelian subalgebra of A generated by {U{s) : s G Hh} 
then the pure state space of C is homeomorphic to {Jj2)^ . 

Proof. The Abelian C*-algebra C is isomorphic to the C*-algebra C{X) of 
continuous complex-valued functions on X, where X is the pure state space 
of C equipped with the weak* topology. Furthermore, if C{X) and C{Y) are 
isomorphic then X and Y are homeomorphic. Thus, if C ~ C{Y) then the 
space of pure states of C is homeomorphic to Y. Now, C ^ <^°liAfi, where 
J\fi is the Abelian algebra generated by at,. Since Aft is isomorphic to C{Z2), 

oo oo 

(g)Ar, ^ (g)C(Z2) ~ CiiZ^r), (35) 
1=1 1=1 

where (^2)*^ is equipped with the product topology (see [121 pp. 910-911; 
Prop. 11.4.3]). Therefore the pure state space of C is homeomorphic to (^2)"^. 

□ 

Since C is isomorphic to C((Z2)'^), there is (by the Riesz representation 
theorem) a one-to-one correspondence between positive normalized measures 
on (^2)"^ and states on C. 

Lemma 6. // /i is the Haar measure on [TL^f then the barycenter of /x is 
t\c, where r is the trace on A. 

Proof. Let a{C) denote the pure state space of C, and let p = /^^^^ ujdp{u) 
be the barycenter of /i. To show that p = r, it will suffice to show that 
p{U{s)) = whenever s E — {e}. Indeed, if s 7^ e then there is an z e N 
such that s{i) = {b,b ® 1). Let s' be the element of ©^1(^2 © ^2)1 such 
that s'{j) = s{j) when j ^ i, and s'(i) = (6 © 1, 6). Then U{s')*U{s)U{s') = 
—U{s). Since p is translation-invariant, p{U{s)) = —p{U{s)). Therefore 
p{Uis)) = 0. □ 

Lemma 7. There is a completely positive projection $ from A onto C such 
that r($(A)) = t{A) for all A m A. 

Proof. For each t G M, define an automorphism at of A by 

at{B) = e-''^^Be''^\ {B e A). (36) 
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Since is bounded, the map t ^— at{B) is norm-continuous. If u is an 
invariant mean on R, then 

= / at{B)du{t), {Be A), (37) 

is a positive hnear map on A 12U\ Lemma 7.4.4]. (To show that $ is com- 
pletely positive, it will suffice to show that the range of $ is Abelian.) 
Clearly ^(CiBCa) = Ci^{B)C2 for all Ci,C2 e C, and B e A. In par- 
ticular, $(C) = C for all C e C. To see that the image of $ lies in C, 
let s be an element of G = X]ieN(^2 © '^2)1- If s e then f/(s) G C and 
$(f/(s)) = ^7(s). Suppose then that s ^ Hh, that is, there is an i G N such 
that either s{i) = {b Q) l,b) or s{i) = (1, 1). (It will suffice to consider the 
ffist case; the second case follows by symmetry.) Then 

U {s) = V;(i) ® ■ ■ ■ ® ® Vs(i) ® Vs(i+i) ® ■ ■ ■ , (38) 

and 

$([/(s)) = Vs(i) ® ■ ■ ■ ® ® ® ® ■ ■ • , (39) 

where 

i^,, = / e-**^" [y(,ei,fe)] e^*''''rfz/(t) = 0. (40) 
Jm. 

Thus, $(t/(s)) = 0. Since {U{s) : s e G} spans ^, it follows that ran($) = C. 
To see that r = ro<|), note that every non-identity element of {U{s) : s G G} 
is trace-free. If s G Hb, then $(f/(s)) = t/(s) and therefore r($([/(s))) = 
r([/(s)). If s ^ Hb, then $([/(s)) = and r{U{s)) = 0. Since r and r o $ 
are continuous linear functionals, r = r o $. □ 

The mapping = $ ® $ is a CP projection from A^ B onto C ® C, and 
its adjoint \E'* is a weak* continuous mapping from the state space of C (8) C 
into the state space of ^ ® ;B. Let a{C ® C) denote the pure state space of 
C®C, and let a{A®B) denote the pure state space of A®B. Using ^* again 
to denote the restriction of \I'* to a{C ® C), and identifying a{C ® C) with 
(Za)'^ X (Zs)"", it follows that ^* is a continuous injection of (Zg)"' x (Za)"" 
into a{A®B). Note that 

^*[{s,s)] = \\b,s))A^\\b,s))B (41) 

and so the mapping 

s ^ \\b, s))a ® \\b, s))b = {^* o A)(s), (42) 
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where A(s) = (s, s), is continuous, which estabhshes the first part of Propo- 
sition m 

Now let pb denote the barycenter of and let i^b =def A* o ($*)^^ denote 
the measure on (t{B) induced by $* from the measure // on a{C). Then for 
any B e B, 

Pb{I®B) = [ u{1 B)dfibiuj) = I uj{B)dvb{uj) (43) 
= I u{^{B))dfx{u) = r($(5)) = t{B). (44) 

Ja{C) 

This estabhshes the second part of Proposition El Thus, po and //i are the 
ensembles prepared by Alice if she follows the protocol honestly. 

Finally, we show that Alice can cheat by preparing an entangled state 
during the Commit stage rather than /io or /ii. In particular, if for each 
i e N, i/ji = ifj is the Bohm-EPR state of M2 ® M2, then u =def is a 

pure state of {Mi ® Mi) = A®B [12]. It is not difficult to see, then, 
that if Alice performs a nonselective measurement of (represented by the 
CP map in Eqn. IHU)) when A® B is ui state a;, then the posterior state is the 
ensemble pb- Therefore, if Alice prepares u during the Commit stage, then 
she can unveil either or 1. 

III. 2 Bit commitment and superselection rules 

It has recently been argued by Mayers, Kitaev, and Preskill ^^QH]; in re- 
sponse to a question raised by Popescu [21], that the no-go theorem for bit 
commitment extends to the case of quantum systems with superselection 
rules. The generalized HJW theorem provides another route to this result, 
at least for systems whose superselection rules are Abelian. In the case of 
Abelian superselection rules, A = B'\ that is, Alice can perform any opera- 
tion that commutes with Bob's measurement operations. And the generalized 
HJW theorem shows that an observer with algebra B' can steer system B 
into any ensemble consistent with dJ^-lg. Thus, a bit commitment protocol 
is perfectly concealing against Bob only if it is not binding against Alice. 
However, the generalized HJW theorem has nothing to say (directly) about 
Alice's ability to cheat when both systems are governed by non-Abelian su- 
perselection rules (in which case A C B'). 

Mayers et al. ^l] claim that — HJW theorem aside — Alice can always 
steer Bob's system into the state of her choice by adding, if necessary, an 



16 



appropriate ancilla to her system. Their argument is based on a more general 
claim that restrictions imposed by superselection rules on a local system can 
always be effectively removed by embedding the local system in a larger 
system (in particular, by adding an ancilla). 

The formalism of elementary quantum mechanics imposes no restriction 
on adding ancillae. However, in the setting of algebraic quantum field the- 
ory, an observer can measure only those observables that correspond to her 
spacetime region. As a result, adding ancillae is not permitted — at least 
if "adding an ancilla" is interpreted to mean that Alice can measure observ- 
ables that are not in her local observable algebra TZ{Oa)- Thus, in this richer 
theoretical framework, Alice is subject to further constraints on her ability to 
simulate any operation that commutes with Bob's measurement operations, 
and these constraints could — it seems theoretically possible — prevent Al- 
ice from cheating in a bit commitment protocol. (It would be interesting 
to explore connections between the formal condition A <ZB' and relativistic 
constraints of the sort exploited by Kent's JT] bit commitment protocol.) 

III. 3 Limitations on the generalized HJW theorem 

Let us say that a bit commitment protocol employs a quantum encoding just 
in case Alice encodes her choice of a bit or 1 in two ensembles /xq or /xi 
of quantum states. Then, even in the case of bit commitment schemes that 
employ quantum encodings, there is one further assumption of the gener- 
alized HJW theorem that is not prima facie guaranteed to hold in any bit 
commitment protocol: the assumption that the barycenter of //f, is a vector 
state. (Let us call this latter assumption the vector state assumption.) 

First, it is not difficult to find pairs of C*-algebras {A,B), and measures 
/ifc on the state space of B such that the vector state assumption does not 
hold: e.g., let B = Ai2, and let be the measure on the state space of B 
that assigns | to each of |(/ + Cb) and ^{I — crt)- (Of course, this trivial 
example could not be used to construct a secure bit commitment protocol, 
since Alice could not perform any non-trivial measurements to verify her 
commitment to Bob.) However, the vector state assumption does hold when 
B has a separating vector in TC. 

Definition. A vector x in the Hilbert space Ti is said to be separating for 
the C*-algebra B just in case Bx = only if i? = for all B & B. 
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Proposition 8 ( jl3|, Thm. 7.3.8]). If B is a C*-algebm acting on the 
Hilbert space Ti and if B has a separating vector x in Ti, then each state 
of B is implemented by some vector in Ti. 

Thus, if B has a separating vector in the Hilbert space Ti (and if ^ = B') 
then any ensemble of states on B corresponds to a state u}x\b induced by 
a vector x in 7i, and the generalized HJW theorem entails that any two 
equivalent ensembles can be prepared at a distance (from a common state). 
For example, B = Ia®B{Hb) has a separating vector in TCa'^'Hb if and only 
if dim(TCB) < dim(7i^) 8 . So, in the case of elementary quantum systems, 
by adding an ancilla, Alice can "make her Hilbert space as large as Bob's", 
which ensures that their joint Hilbert space TC = (Ha' ® Ti-A) ®'Hb contains 
a vector representative of each of Bob's states. 

Nonetheless, there are C*-algebras that do not have — and could not 
have, in any faithful representation — a separating vector, e.g., C*-algebras 
which contain an uncountable family of mutually orthogonal projection op- 
erators. But if B does not have a separating vector, then the HJW theorem 
doesn't show that an observer with algebra B' could perform operations that 
prepare any one of two equivalent measures on the state space of B (from 
a common ancestor state). Until the HJW theorem is generalized to cover 
such cases, there remains a small, but theoretically crucial, loophole in cur- 
rent proofs of the impossibility of secure bit commitment. 

IV. Conclusion 

We have shown, subject to a mild constraint (viz., that the systems in- 
volved are "hyperfinite" ) , that any two equivalent measures on the state 
space of a C*-algebra can be prepared "at a distance". This result general- 
izes the Hughston-Jozsa-Wootters theorem, and so can be used to extend the 
Mayers-Lo-Chau argument against the security of quantum bit commitment 
protocols. 

However, the results proved to date — including the results in this paper 
— are not yet sufficient to rule out the security of any conceivable quan- 
tum bit commitment protocol. First, it remains an open question whether 
an analogue of the HJW theorem holds for any system whose observables 
can be represented by self-adjoint operators in some abstract (not necessar- 
ily nuclear) C*-algebra. Second, in order to invoke the HJW theorem in an 
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argument against bit commitment, one must make further physical assump- 
tions — e.g., that the states on Bob's system correspond to vector states 
of some larger system S, and that Alice can perform any operation on S 
that commutes with Bob's measurement operations — that have yet to be 
justified in a fully general context. 
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